nx_cap_grant_e2e_gate.nx source
↩ module page · 106 lines · 7174 B
1// nx_cap_grant_e2e_gate.nx -- THE CAPSTONE: proves the ENTIRE production MCP-grant path end-to-end, offline, with a
2// REAL CSPRNG keyfile on disk (NOT the placeholder). Composes every piece that ships to the NAS in the exact wiring
3// a granted mcp__nishi__* call hits in production:
4// nx_cap_keygen (ck_provision writes tools_cap_secret.key) -> the SERVER's own loader (ta_load_cap_secret reads it)
5// -> mint a token against that same on-disk key (capt_issue) -> present it via the X-Nishi-Cap HEADER on a real
6// POST /mcp tools/call -> ta_handle_pfx verifies vs the loaded keyfile + runs the GREEN-allowlisted organ with the
7// parsed argv -> real fork+capture. The ONLY thing not exercised here is the network/edge relay + the deploy.
8// license_tier: ORIGINAL expect_exit: 0
9import "nx_tools_api.nx" // ta_handle_pfx + ta_load_cap_secret + ta_cap_provisioned + tool_register_pfx + capt_issue/capt_slen (transitive) + sys_*
10import "nx_cap_keygen.nx" // ck_provision (real CSPRNG keyfile provisioning) + CK_OK
11import "nx_gate.nx" // gw / gn
12
13const GE_KEYFILE: *u8 = "tools_cap_secret.key" as *u8 // MUST equal nx_tools_api TA_CAP_KEYFILE (CWD-relative)
14const GE_CONF: *u8 = "tool_allowlist.conf" as *u8 // MUST equal nx_tool_exec_allow TEA_CONF
15const GE_REVOKED: *u8 = "cap_revoked.list" as *u8 // cleared for determinism
16
17func ge_cat(d: *u8, o: i64, s: *u8) -> i64 { var i: i64=0; while s[i]!=(0 as u8){ d[o+i]=s[i]; i=i+1 } return o+i }
18func ge_catb(d: *u8, o: i64, s: *u8, n: i64) -> i64 { var i: i64=0; while i<n { d[o+i]=s[i]; i=i+1 } return o+n }
19func ge_has(out: *u8, n: i64, needle: *u8) -> i64 { if ta_indexof(out, n, needle) >= 0 { return 1 } return 0 }
20func ge_eqn(a: *u8, b: *u8, n: i64) -> i64 { var i: i64=0; while i<n { if a[i]!=b[i] { return 0 } i=i+1 } return 1 }
21func ge_write_file(path: *u8, content: *u8) -> i64 {
22 let fd: i64 = __syscall(257, 0 - 100, path, 0x241, 0x1a4, 0, 0) // O_WRONLY|O_CREAT|O_TRUNC, 0644
23 if fd < 0 { return 0 - 1 }
24 var n: i64 = 0; while content[n] != (0 as u8) { n = n + 1 }
25 sys_write(fd, content, n); sys_close(fd)
26 return 0
27}
28// build a POST /mcp tools/call presenting the cap via the X-Nishi-Cap HEADER (the production .mcp.json form) with
29// params.name=tool and params.arguments.argv=argvj (a JSON string-array literal).
30func ge_build_call_hdr(req: *u8, tool: *u8, tok: *u8, tlen: i64, argvj: *u8) -> i64 {
31 var o: i64 = ge_cat(req, 0, "POST /mcp HTTP/1.1\r\nHost: x\r\nContent-Type: application/json\r\nX-Nishi-Cap: " as *u8)
32 o = ge_catb(req, o, tok, tlen)
33 o = ge_cat(req, o, "\r\n\r\n{\"jsonrpc\":\"2.0\",\"id\":9,\"method\":\"tools/call\",\"params\":{\"name\":\"" as *u8)
34 o = ge_cat(req, o, tool)
35 o = ge_cat(req, o, "\",\"arguments\":{\"argv\":" as *u8)
36 o = ge_cat(req, o, argvj)
37 o = ge_cat(req, o, "}}}" as *u8)
38 return o
39}
40func ge_expect(cond: i64, pass: *i64, tot: *i64, label: *u8) -> i64 {
41 tot[0] = tot[0] + 1
42 if cond == 1 { pass[0] = pass[0] + 1; gw(" [PASS] " as *u8) } else { gw(" [FAIL] " as *u8) }
43 gw(label); gw("\n" as *u8)
44 return 0
45}
46
47func main() -> i64 {
48 gw("=== nx_cap_grant_e2e_gate: FULL production MCP grant with a REAL CSPRNG keyfile (keygen->load->mint->call->exec) ===\n" as *u8)
49 __syscall(87, GE_KEYFILE, 0, 0, 0, 0, 0) // clean slate (deterministic)
50 __syscall(87, GE_REVOKED, 0, 0, 0, 0, 0)
51
52 let TP: *u8 = "knowledge/toolreg-test-e2e-" as *u8
53 tool_register_pfx(TP, "argecho" as *u8, "multi-arg witness" as *u8, "argecho <args...>" as *u8, "gate-proven" as *u8)
54 if ge_write_file(GE_CONF, "# grant e2e\nargecho\t_offc/nx_tool_argecho.elf\tGREEN\n" as *u8) != 0 { gw("FAIL: cannot write allowlist\n" as *u8); sys_exit(1); return 1 }
55
56 let pbox: *i64 = sys_mmap(16) as *i64; pbox[0] = 0
57 let tbox: *i64 = sys_mmap(16) as *i64; tbox[0] = 0
58 let out: *u8 = sys_mmap(1048576)
59 let req: *u8 = sys_mmap(8192)
60
61 // T1: provision a REAL keyfile at the exact path the server reads
62 let kbuf: *u8 = sys_mmap(128)
63 let klp: *i64 = sys_mmap(16) as *i64
64 let rc: i64 = ck_provision(GE_KEYFILE, 1, kbuf, klp)
65 var t1: i64 = 0
66 if rc == CK_OK { if klp[0] == 64 { t1 = 1 } }
67 ge_expect(t1, pbox, tbox, "T1 nx_cap_keygen wrote a real 256-bit keyfile at tools_cap_secret.key" as *u8)
68
69 // T2: the SERVER now reports provisioned (its own /api/cap/status probe flips)
70 ge_expect(ta_cap_provisioned(), pbox, tbox, "T2 server /api/cap/status would report provisioned (real key loaded)" as *u8)
71
72 // T3: the SERVER's loader reads back EXACTLY the bytes keygen wrote (the load seam)
73 let slb: *i64 = sys_mmap(16) as *i64
74 let sload: *u8 = ta_load_cap_secret(slb)
75 var t3: i64 = 0
76 if slb[0] == 64 { if ge_eqn(sload, kbuf, 64) == 1 { t3 = 1 } }
77 ge_expect(t3, pbox, tbox, "T3 server ta_load_cap_secret reads back the exact 64 keyfile bytes (load seam)" as *u8)
78
79 // T4 (CAPSTONE): mint a cap against the ON-DISK key, present via X-Nishi-Cap HEADER, call argecho with argv ->
80 // the server verifies against the loaded keyfile and forks the organ with the args. The whole grant, end to end.
81 let tok: *u8 = sys_mmap(1024)
82 let tn: i64 = capt_issue(kbuf, klp[0], "argecho" as *u8, 7, 9999999999, 90001, tok, 1024)
83 let rn: i64 = ge_build_call_hdr(req, "argecho" as *u8, tok, tn, "[\"one\",\"two\",\"three\"]" as *u8)
84 let on: i64 = ta_handle_pfx(TP, req, rn, out)
85 var t4: i64 = 0
86 if ge_has(out, on, "NX_TOOL_ARGECHO_OK" as *u8) == 1 { if ge_has(out, on, "one" as *u8) == 1 { if ge_has(out, on, "two" as *u8) == 1 { if ge_has(out, on, "three" as *u8) == 1 { if ge_has(out, on, "\"isError\":false" as *u8) == 1 { t4 = 1 } } } } }
87 ge_expect(t4, pbox, tbox, "T4 CAPSTONE: real-key token via X-Nishi-Cap header -> verified vs keyfile -> argecho ran with argv" as *u8)
88
89 // T5 (neg): a token minted against a DIFFERENT key is DENIED even though the server has a real keyfile -- proving
90 // the server truly verifies against the ON-DISK key, not the placeholder and not "anything".
91 let k2s: *u8 = "a-totally-different-signing-key-do-not-match-000000" as *u8
92 let tok2: *u8 = sys_mmap(1024)
93 let tn2: i64 = capt_issue(k2s, capt_slen(k2s), "argecho" as *u8, 7, 9999999999, 90002, tok2, 1024)
94 let rn2: i64 = ge_build_call_hdr(req, "argecho" as *u8, tok2, tn2, "[\"one\"]" as *u8)
95 let on2: i64 = ta_handle_pfx(TP, req, rn2, out)
96 var t5: i64 = 0
97 if ge_has(out, on2, "-32001" as *u8) == 1 { if ge_has(out, on2, "NX_TOOL_ARGECHO_OK" as *u8) == 0 { t5 = 1 } }
98 ge_expect(t5, pbox, tbox, "T5 neg: token minted with a WRONG key -> -32001, organ NOT run (server verifies vs the keyfile)" as *u8)
99
100 __syscall(87, GE_KEYFILE, 0, 0, 0, 0, 0) // never leave a secret behind
101 __syscall(87, GE_REVOKED, 0, 0, 0, 0, 0)
102
103 gw("\n=== nx_cap_grant_e2e_gate " as *u8); gn(pbox[0]); gw("/" as *u8); gn(tbox[0]); gw(" ===\n" as *u8)
104 if pbox[0] == tbox[0] { gw("GRANT-E2E GREEN -- the full production MCP grant works offline with a real CSPRNG keyfile; only deploy + NAS allowlist paths remain\n" as *u8); sys_exit(0); return 0 }
105 gw("GRANT-E2E RED\n" as *u8); sys_exit(1); return 1
106}